SOC 2 — System and Organization Controls
An attestation framework built on the AICPA's Trust Services Criteria, used overwhelmingly by SaaS and technology vendors to demonstrate security, availability, confidentiality, processing integrity and privacy controls to enterprise customers.
Who it applies to
- SaaS and technology service providers responding to enterprise due diligence
- Organisations wanting independent assurance over their control environment
- Vendors for whom a SOC 2 report shortens customer security review cycles
Key requirements
- Controls mapped to the relevant Trust Services Criteria
- Independent CPA firm assessment (Type I: point in time, Type II: over a period)
- Evidence that controls operated effectively throughout the observation window
- Increasingly, penetration testing evidence to support CC4.1 monitoring criteria
- A formal report issued for controlled distribution to customers and prospects
Maximum penaltyNot statutory — an unfavourable opinion or lack of a report can directly affect enterprise sales and procurement outcomes
Official resources
Praeferre's summary is a starting point, not legal advice. For the authoritative text and current guidance, go directly to the governing body.
Questions we get asked
SOC 2 applies to: SaaS and technology service providers responding to enterprise due diligence; Organisations wanting independent assurance over their control environment; Vendors for whom a SOC 2 report shortens customer security review cycles.
The core obligations are: Controls mapped to the relevant Trust Services Criteria; Independent CPA firm assessment (Type I: point in time, Type II: over a period); Evidence that controls operated effectively throughout the observation window; Increasingly, penetration testing evidence to support CC4.1 monitoring criteria; A formal report issued for controlled distribution to customers and prospects. Each is summarised in plain English above, with a link to the official text.
Effective: Ongoing — Type II reports cover a defined observation period, typically 6–12 months. Regulator: American Institute of CPAs (AICPA).
Not statutory — an unfavourable opinion or lack of a report can directly affect enterprise sales and procurement outcomes.
Praeferre's GRC Automation engine monitors the policies, document repositories and web pages that carry your risk under SOC 2, on a cadence you set, and turns every scan into an audit trail you can put in front of an auditor or regulator.
See how Praeferre automates SOC 2 compliance
Continuous monitoring, evidence and reporting for SOC 2 — alongside every other framework you need to satisfy.